Best practices for using Ansible Vault: SSH keys and pushing Vault to Git?

Narfyx
Tue, 09 Sep 2025 10:55:10 +0000
Get Help

Hello everyone

I’m a French student working on a school project where we migrate an on-premises application to AWS using Ansible.
The infrastructure is deployed on AWS (EC2, RDS, etc.) and Ansible is used for configuring the servers.

In my current inventory, I defined sensitive variables like db_user and db_pass directly in YAML files.
It works, but I know this is a practice that should be completely avoided outside of a school context.

While reworking this project to improve it, I discovered Ansible Vault.
Now I would like to ask:

Is it possible (and recommended) to also store SSH keys in Ansible Vault?

Is it safe to push a Vault-encrypted file to Git? (I assume yes since it’s encrypted, but I’m still doubtful when thinking about a production use case ).

Thanks in advance for your advice and feedback!

4 posts - 4 participants